The policy discloses a set of data subject rights including access, rectification, deletion, restriction, portability, consent withdrawal, and complaint rights, available depending on the user's jurisdiction. Requests can be submitted through the account interface, privacy.openai.com, or by email to dsar@openai.com.
This analysis describes what OpenAI's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes the mechanisms through which users can exercise statutory data rights. The policy qualifies all listed rights with 'depending on where you live,' which means the availability of each right depends on the user's jurisdiction and applicable law rather than being uniformly available to all users.
The updated policy explicitly discloses that OpenAI receives information from advertisers and other data partners for Free and Go users, and uses this data to personalize ads and measure ad effectiveness. The policy now states that Free and Go users can control what data OpenAI uses to personalize ads through advertising controls in account settings. This represents clarified disclosure of an existing practice rather than a new authorization.
View change record →The updated privacy policy now explicitly states that OpenAI receives information from advertisers and other data partners, which is used to personalize ads shown to Free and Go users and to measure the effectiveness of those ads. For example, the policy notes that OpenAI could receive information about purchases users make from advertisers. The policy now includes a dedicated section on ad personalization and measurement as a primary use of personal data for these user tiers. You can manage what data OpenAI uses for ad personalization by accessing the advertising controls in your account settings or by using the Data Controls option.
View change record →The updated policy now explicitly authorizes OpenAI to promote products and services to users through direct marketing on third-party properties and to share limited information with select marketing partners (who are not service providers) to support these efforts. The policy states that some marketing partners may receive information through cookies and similar technologies. The revised terms establish that these marketing practices are subject to user choices and controls, with additional information and opt-out options available. You can make choices about the use of your information for third-party product promotion purposes through controls referenced in the policy.
View change record →Removal of the general enumeration of user rights (access, rectification, deletion, restriction, portability, consent withdrawal) replaces it with procedure-focused provisions lacking explicit rights listing.
View full change record →Under this clause, users may exercise access, deletion, correction, portability, restriction, and consent withdrawal rights through the account interface, the privacy portal at privacy.openai.com, or by emailing dsar@openai.com, subject to the jurisdictional availability of each right and applicable verification requirements.
Cross-platform context
See how other platforms handle User Rights and Data Subject Access Requests and similar clauses.
Compare across platforms →"Depending on where you live, you may have certain statutory rights in relation to your Personal Data. For example, you may have the right to: Access your Personal Data and information relating to how it is processed. Rectify or update your Personal Data Delete your Personal Data from our records. Restrict how we process your Personal Data. Transfer your Personal Data to a third party (right to data portability). Withdraw your consent—where we rely on consent as the legal basis for processing. Lodge a complaint with your local data protection authority. You can exercise some of these rights through your OpenAI account using the tools described in the Data controls section, or you can submit your request through privacy.openai.com or to dsar@openai.com.Excerpt from OpenAI's Privacy Policy
1) REGULATORY LANDSCAPE: The rights listed engage GDPR (Articles 15-21 for EEA users via a separate policy), CCPA and CPRA (California), and comprehensive privacy statutes in multiple US states including Colorado, Connecticut, Virginia, Texas, and …
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Search "[your state] attorney general consumer complaint" to find your state's direct complaint form
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision establishes the mechanisms through which users can exercise statutory data rights. The policy qualifies all listed rights with 'depending on where you live,' which means the availability of each right depends on the user's jurisdiction and applicable law rather than being uniformly available to all users.
Under this clause, users may exercise access, deletion, correction, portability, restriction, and consent withdrawal rights through the account interface, the privacy portal at privacy.openai.com, or by emailing dsar@openai.com, subject to the jurisdictional availability of each right and applicable verification requirements.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by OpenAI.